CVE-2024-30602: Tenda FH1203 Buffer Overflow Vulnerability

CVE-2024-30602 Overview

CVE-2024-30602 is a stack overflow vulnerability in the Tenda FH1203 router running firmware version 2.0.1.6. The flaw resides in the setSchedWifi function, where the schedStartTime parameter is processed without proper bounds checking. An unauthenticated attacker can send a crafted HTTP request over the network to overflow the stack buffer. Successful exploitation can lead to arbitrary code execution or denial of service on the affected device. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input).

Critical Impact
Unauthenticated remote attackers can trigger a stack overflow in the setSchedWifi handler, potentially gaining code execution on the router and pivoting into internal networks.

Affected Products

Tenda FH1203 router (hardware)
Tenda FH1203 firmware version 2.0.1.6
Deployments exposing the router web management interface

Discovery Timeline

2024-03-28 - CVE-2024-30602 published to NVD
2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-30602

Vulnerability Analysis

The Tenda FH1203 web management interface exposes the setSchedWifi function, which accepts user-supplied scheduling parameters for Wi-Fi operation. The schedStartTime parameter is copied into a fixed-size stack buffer without validating its length. Supplying an oversized value overruns the buffer and corrupts adjacent stack memory, including saved return addresses.

Because the device is a MIPS-based embedded router with limited memory protections, overwriting the return address allows redirection of execution flow. Attackers can chain return-oriented programming (ROP) gadgets in firmware to achieve arbitrary code execution. The interface requires no authentication for the affected request path, which lowers the barrier for exploitation.

Refer to the GitHub IoT Vulnerability Documentation for proof-of-concept request structure and parameter details.

Root Cause

The root cause is missing input length validation in the setSchedWifi request handler. The function uses an unsafe string copy operation to move attacker-controlled data from the HTTP request into a stack buffer. No boundary check enforces the maximum expected length of schedStartTime, which violates the [CWE-120] coding pattern.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted HTTP POST request to the router management endpoint with an oversized schedStartTime value. If the management interface is exposed to the WAN or reachable from a compromised internal host, exploitation does not require user interaction. The vulnerability is described in prose only because no verified exploit code is published in the source advisory.

Detection Methods for CVE-2024-30602

Indicators of Compromise

HTTP POST requests to the router management interface containing abnormally long schedStartTime parameter values
Unexpected reboots or crashes of the Tenda FH1203 device, which can indicate failed exploitation attempts
Outbound connections from the router to unknown hosts after suspicious management traffic

Detection Strategies

Inspect web traffic to router management endpoints for requests targeting setSchedWifi with non-standard parameter lengths
Deploy network intrusion detection signatures that flag HTTP requests containing schedStartTime values exceeding expected boundaries
Correlate router crash logs and reboot events with preceding inbound HTTP requests from external sources

Monitoring Recommendations

Log all administrative HTTP requests to network infrastructure devices and forward them to a centralized SIEM
Monitor router availability and CPU metrics for anomalies indicating exploitation attempts
Alert on any inbound connections from the internet to the router management interface

How to Mitigate CVE-2024-30602

Immediate Actions Required

Restrict access to the FH1203 management interface to trusted internal management networks only
Disable WAN-side administration on the router until a vendor patch is available
Inventory all Tenda FH1203 devices running firmware 2.0.1.6 across the environment
Place vulnerable routers behind a firewall that blocks unsolicited inbound HTTP traffic

Patch Information

No vendor advisory or firmware update from Tenda is referenced in the NVD entry for CVE-2024-30602 at the time of publication. Operators should monitor the Tenda support portal for firmware releases superseding version 2.0.1.6 and apply them as soon as they become available.

Workarounds

Segment router management interfaces onto a dedicated VLAN reachable only from administrative hosts
Apply ACLs on upstream devices to drop HTTP requests targeting the FH1203 management port from untrusted sources
Replace end-of-life or unpatched FH1203 units with supported hardware where a vendor fix is not forthcoming
Enable detailed logging on perimeter devices to capture exploitation attempts for incident response

bash

# Configuration example: block external access to the router management interface
# Example iptables rule on an upstream Linux gateway
iptables -A FORWARD -p tcp -d <FH1203_LAN_IP> --dport 80 \
  ! -s <ADMIN_SUBNET>/24 -j DROP
iptables -A FORWARD -p tcp -d <FH1203_LAN_IP> --dport 443 \
  ! -s <ADMIN_SUBNET>/24 -j DROP